Every time your app touches health data, you need explicit permission. Not buried-in-terms-of-service permission. Real, "I understand what you're doing with my colonoscopy results" permission.
The expensive mistakes happen when engineers think:
"It's anonymized" (it's not)
"We're just storing it" (still need consent)
"The hospital gave it to us" (their consent ≠ your consent)
The Three Questions That Matter
Every consent form boils down to three questions:
What data? ("We need your lab results")
Why? ("To check drug interactions")
Who sees it? ("Your doctor and pharmacist")
Mess up any of these, and you're in lawsuit territory.
Here's what I learned the hard way: patients don't read consent forms. They click through them like iTunes terms of service. Your job is to make it impossible to misunderstand.
The Data Problem
Doctors think in categories: "clinical data," "lab results," "imaging."
Patients think in specifics: "my HIV test," "that embarrassing rash photo."
Build for patients.
// Bad consent"We collect your clinical data for treatment purposes."// Good consent"We collect:-Yourmedications(to check interactions)-Yourallergies(so we don't kill you)
I help teams ship AI in production — audits, consulting, custom agents, and eval systems. Start with an AI Audit (from $5k) for an honest read on what to build.
Never use broad purposes. I watched a startup die because their consent said "healthcare operations." Turns out that included selling data to pharma companies. The FTC was not amused.
Be stupidly specific:
❌ "Research purposes"
✅ "To study if this diabetes medication works for people over 65"
The Recipient Reality
Every system your data touches needs to be listed. Miss one? That's a breach.
True story: We forgot to mention our error logging service sees data. Sentry captured a patient name in an error message. Instant HIPAA violation. $50,000 lesson.
What consent actually looks like in production
Authorization Under 45 CFR § 164.508 (And When Part 2 Complicates Everything)
Quick clarification on the regulatory citation engineers get wrong: patient authorization for uses and disclosures of PHI lives in 45 CFR § 164.508 — the HIPAA Privacy Rule, under Title 45 of the CFR. If you see "Part 11" floating around your team's documentation, that's 21 CFR Part 11, which governs electronic records and signatures in FDA-regulated clinical trials. Completely different statute, different agency, different problem.
The required elements for a valid authorization under 45 CFR § 164.508:
// Every authorization must include all of these — missing one voids itconst authorization ={description:"Medications and recent lab results",// what datadisclosingParty:"Cedar Memorial Health System",// who's sharingrecipient:"Dr. Smith, Nashville Cardiology Group",// who's receivingpurpose:"Cardiology consultation for heart condition",// whyexpires:"2024-12-31",// expiration date or eventsignature: patient.signature,// patient signaturedate:newDate().toISOString(),}
Where it gets materially more restrictive: 42 CFR Part 2, which governs records from federally-assisted substance use disorder treatment programs. This is a separate regulation under a separate statutory authority. It's not a variant of HIPAA, not a stricter version of HIPAA. If your system handles SUD treatment records from a federally-funded program, Part 2 applies on top of HIPAA, and it adds requirements HIPAA doesn't have.
The CARES Act (2020) and the final implementing rule (effective April 2024) modernized Part 2: patients can now provide a single consent for treatment, payment, and healthcare operations, similar to the HIPAA model. The additional Part 2 restrictions beyond that still apply, and historically the rules required consent so specific it named individual providers.
// Standard HIPAA authorization — general consent valid under 45 CFR § 164.508"Share my records with any doctor treating me"// 42 CFR Part 2 — SUD records from a federally-assisted program.// The 2024 rule allows TPO consent now, but specificity still matters// for anything outside treatment, payment, or healthcare operations:"Share my substance use disorder records withDr.Smith at
CedarHospitalfor diabetes treatment fromJan-March2024"
I built a system that auto-populated provider names for Part 2 consents. It worked great until a doctor changed practices. Suddenly we're sharing addiction history with the wrong clinic. That was a fun deposition.
The Audit Trail From Hell
Here's what the lawyers don't tell you: every consent needs an audit trail that would make the NSA jealous.
You need to track:
Who consented
When they consented
What version of the form they saw
Their IP address
Browser fingerprint
Whether they actually scrolled to the bottom
How long they spent reading
If they downloaded a copy
Miss any of these? Good luck proving consent in court.
Version your consent forms like software. When the lawyers update paragraph 3, that's a new version. You'll thank me during the audit.
What Engineers Actually Need to Build
The Minimum Viable Consent System
Forget the enterprise architect's 200-page spec. Here's what you actually need:
// 1. Consent StorageinterfaceConsent{id: string
patientId: string
scope:ConsentScope[]// Specific data typespurpose: string[]// Specific usesrecipients: string[]// Specific people/orgsexpires:Date// Yes, consent expiresversion: string // Form versionaudit:AuditTrail}// 2. Consent Checking (you'll call this 1000x/day)asyncfunctioncanShare(dataType: string,purpose: string,recipient: string){const consents =awaitgetActiveConsents(patientId)return consents.some(c=> c.scope.includes(dataType)&& c.purpose.includes(purpose)&& c.recipients.includes(recipient)&& c.expires>newDate())}// 3. The UI (keep it simple)<ConsentForm><Summary>Dr.Smith wants to see your medications</Summary><Details>To check for drug interactions</Details><Duration>For the next 30 days</Duration><Actions><Accept/><Decline/><LearnMore/></Actions></ConsentForm>
The Gotchas That Cost Millions
1. Implicit Consent Doesn't Exist
User uploads their medical records to your app? You still can't share them. Not even with their doctor. Not even in an emergency. Get explicit consent for every use.
2. Consent Isn't Transitive
Patient consents to share with Hospital A. Hospital A wants to share with Lab B. You need new consent. Every. Single. Time.
3. Revocation Is Instant
Patient revokes consent at 3:47 PM? Any sharing after 3:47:01 PM is a violation. Build real-time revocation or prepare for lawsuits.
4. Break Glass Isn't Magic
"Break glass" access for emergencies? Still need to document:
Who broke the glass
Why they broke it
What they accessed
When they accessed it
Did it meet your emergency criteria?
One hospital paid $2.5M because their "emergency" included looking up a celebrity's STD results.
Consent Engine is separate - Not part of your app logic
Every request checks consent - No exceptions
Audit everything - Storage is cheap, lawsuits aren't
Fail closed - No consent = no access
Real Problems and Real Solutions
The 80-Year-Old Problem
Your beautifully designed consent form with Material UI components? Grandma can't use it.
I learned this at a rural clinic. Our "intuitive" interface required:
Creating an account
Verifying email
Two-factor auth
Digital signature
Their solution? Print the form, have patients sign it, then the nurse enters it into our system. We built a $100K solution for a pen and paper problem.
Building for one? Congrats, you support 5% of hospitals.
The only solution that works: Build your own consent service and make the EHRs call you.
The Lawyer Problem
Legal reviews your consent form. Changes three words. Now you need:
New version number
Migration plan for old consents
Re-consent strategy
Audit trail of who saw which version
One client had 47 versions in 18 months. We built this:
classConsentVersionManager{asyncgetActiveVersion(context){// Different versions for different statesif(context.state==='CA')return'v2.3-CA'if(context.isMinor)return'v2.3-minor'if(context.substanceUseDisorder)return'v2.3-part2'// 42 CFR Part 2 appliesreturn'v2.3'}asyncrequiresReconsent(oldVersion, newVersion){// Legal team maintains this matrixreturnRECONSENT_MATRIX[oldVersion][newVersion]}}
The Performance Problem
Checking consent on every API call? That's thousands of database hits.
Bad solution: Cache everything (HIPAA violation when consent is revoked)
Good solution: Smart caching with instant invalidation
// Redis-backed consent cacheclassConsentCache{asynccheck(patientId, dataType, purpose, recipient){const key =`consent:${patientId}:${dataType}:${purpose}:${recipient}`// Check cache firstlet result =await redis.get(key)if(result !==null)return result ==='true'// Check database result =await db.checkConsent(...)// Cache with TTLawait redis.setex(key,300, result)// 5 minute TTLreturn result
}asyncrevoke(patientId){// Nuclear option: clear all patient's consent cacheconst keys =await redis.keys(`consent:${patientId}:*`)await redis.del(...keys)}}
What's Actually Coming (And What's BS)
The Blockchain Nonsense
Every healthcare conference: "Blockchain will revolutionize consent!"
Reality: I've seen 12 blockchain consent POCs. Zero in production. Why?
Patients can't manage private keys
HIPAA requires data deletion (blockchain doesn't delete)
51% attack = all consent history compromised
Gas fees for consent updates? Really?
Stop trying to make blockchain happen. It's not going to happen.
Patients changing consent in real-time based on context:
Share with ER? Yes
Share with pharma research? No
Share with my regular doctor? Yes
Share for billing? Required by law anyway
3. Consent as a Service
Forget building your own. Companies like Privacera and OneTrust are building HIPAA-specific consent platforms. Not perfect, but better than your homebrew solution.
The Compliance Changes That Matter
Information Blocking Rules (Live Now)
Can't hide behind "no consent" to block data sharing
Must share unless patient explicitly opts out
$1M penalties per violation
TEFCA (Coming Soon)
National consent framework
One consent works across networks
But every state has different rules
State Privacy Laws (The Real Nightmare)
California: Delete means delete
Texas: Biometric consent required
Illinois: Sue anyone for anything
Washington: Good luck figuring it out
The Bottom Line
After three years of building consent systems, here's what I know:
Perfect consent is impossible - Aim for defensible
Lawyers make it worse - But you still need them
Patients don't care - Until something goes wrong
Auditors definitely care - Document everything
The tech is easy - The policy is hard
Start simple. Track everything. When in doubt, ask for more consent.
The $50K you spend on a consent system is cheaper than the $5M HIPAA fine.
